Network telemetry with byte distribution and cryptographic protocol data elements

3. The method of claim 2, wherein the one or more unencrypted packets further include information to establish an encrypted connection using the cryptographic protocol.

4. The method of claim 2, wherein the telemetry data of the traffic flow further includes at least one of: a source IP address of the traffic flow, a destination IP address of the traffic flow, a start time of the traffic flow, a stop time of the traffic flow, a protocol associated with the traffic flow, a number of bytes of the traffic flow, and a number of the plurality of packets.

5. The method of claim 2, wherein the telemetry data of the traffic flow further includes a sequence of packet lengths and times (SRLT) for one or more of the plurality of packets.

6. The method of claim 2, wherein the telemetry data of the traffic flow further includes a byte value distribution metric.